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ABSTRACT 



System and method for managing telecommunications net- 
works. The state of network elements is managed by asso- 
ciating and correlating network events across many different 
network domains. Network elements include tangible 
elements, such as hardware and equipment, and non-tangible 
elements, such as customers, countries, and services. By 
incorporating an inferencing engine or expert system, 
sources of network problems are inferred, impacts of net- 
work events are assessed, and corrective actions are recom- 
mended 

43 Claims, 13 Drawing Sheets 
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SYSTEM AND METHOD FOR MANAGING A 
TELECOMMUNICATIONS NETWORK BY 
ASSOCIATING AND CORRELATING 
NETWORK EVENTS 

5 

BACKGROUND OF THE INVENTION 

1. Held of the Invention 

The present invention relates generally to telecommuni- 
cations network management. More particularly, the present 10 
inventions relates to a system and method for state- 
management of network elements that incorporates the 
impact of network events from different domains of the 
network. 

2. Related Art is 
Commercial telecommunications networks must function 

properly in any environment or condition to successfully 
deliver customer traffic. However, due to their wide geo- 
graphical coverage and technically complex nature, tele- 
communications networks are vulnerable to frequent traffic- 20 
impacting problems. 

Telecommunications network management personnel 
must monitor several sources of network data. These data 
represent various network events, such as fiber cuts, switch 
outages, and call blockage. Often, several different data from 25 
different sources may be generated as a result of the same, 
single event. It is difficult for network management person- 
nel to piece together these disparate data and arrive at a 
conclusion regarding the cause of such events. It is also 
difficult for them to analyze these disparate data to determine 30 
the current state of the network. 

Accordingly, telecommunications networks require 
sophisticated network management systems to provide vis- 
ibility to the condition of the entire network and any 35 
problems that occur, such as fiber cuts and switch outages. 
These systems must also enable network management per- 
sonnel to quickly analyze the problem and determine the 
optimal solution for restoring traffic. In order to meet these 
objectives, a telecommunications network management sys- ^ 
tern must perform several functions. Such a system would 
monitor network events, associate related events with each 
other, infer possible root causes of events, determine impact 
of events in terms of customer traffic, present the current 
state of the network, and recommend appropriate actions. 43 

However, conventional telecommunications network 
management systems do not meet these objectives. Conven- 
tional telecommunications network management systems 
monitor alarms and report when an alarm is triggered. Such 
alarms may indicate that noise levels or blocked calls have ^ 
exceeded a preset threshold, or that a communications link 
has been broken. Network management personnel must then 
correlate these disparate alarms and infer the source of the 
problem, such as a fiber cut or switch outage. Network 
management personnel must then determine a solution from 55 
their inference, and take appropriate action. 

These conventional telecommunications network man- 
agement systems have many shortcomings since they do 
little more than report events. They do not present the 
current state of the network or how that state has recently 
changed. Conventional telecommunications network man- 
agement systems represent the network only as a collection 
of physical elements, such as switches and multiplexing 
equipment. 

Conventional telecommunications network management 65 
systems are also subject to systemic errors that may produce 
anomalous results. This is due to the fact that actions of 



502 

2 

conventional systems are based on receipt of a sequence of 
alarms. For example, if an alarm A is triggered by a 
transmission failure, and the resulting blocked calls on a 
switch triggers an alarm B. a conventional network man- 
agement system may receive alarm B prior to receiving 
alarm A. In fact, numerous related alarms may be received 
in any order. This fact makes it difficult for a conventional 
system to determine if all related alarms have been received, 
and to then correlate related events. 

Another drawback of conventional network management 
systems is that they receive event information from several 
different sources, and then present this information in the 
same detached and unrelated manner. This requires the 
network manager to compose the proper scenario by manu- 
ally correlating information from the different sources. 

Since conventional systems are limited to reporting 
events, they require the network manager to manually cor- 
relate reported events and to infer possible root problems. 
This requires a high level of expertise and experience on the 
part of the network manager. It also requires extra time for 
a network manager to perform these functions. 

Conventional network management systems do not pro- 
vide correlation that spans multiple domains (i.e.. 
transmission, switching, traffic). As such, they are extremely 
limited in their ability to recommend corrective actions. 
Most actions needed to resolve a network problem must 
therefore be suggested by the network manager. 

There is thus a need for a telecommunications network 
management system that provides network management 
personnel with an integrated view of the current state of the 
network, that correlates related network events, and that 
recommends corrective action. 

SUMMARY OF THE INVENTION 

The present invention is a system and method for man- 
aging telecommunications networks. The present invention 
manages the state of network elements by associating and 
correlating network events across many different network 
domains. The network elements include not only network 
hardware and equipment, but also non-tangible elements 
such as customers, countries, and services. In addition to 
correlating network events, the present invention infers 
sources of problems, assesses impacts of network events, 
and provides recommendations based on network state 
changes. 

In one aspect of the invention, a method for managing a 
telecommunications network is provided. In this method, a 
network object database is maintained. The network object 
database is made up of network objects, each corresponding 
to a network element Each network object is defined by a 
set of attributes. The value of each attribute represents the 
current state of the corresponding network element When 
network information (network event information or network 
topology information) is received, network objects impacted 
by the information are identified as impacted network 
objects. The impacted attributes are also identified. The 
impacted network objects correspond to network elements 
impacted by the network information. Hie values of the 
impacted attributes are changed in a network object database 
to reflect the impact of the network information. In this 
manner, the current state of the impacted network elements 
is updated with a state change. The current and updated state 
of the network elements is provided to a network manage- 
ment workstation. 

The network object database may be maintained by 
maintaining: a network topology object database that con- 
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tains the network objects; a call data object database that FIG. 1 shows a block diagram that illustrates the three- 
contains call data objects that correspond to data contained tiered network management hierarchy implemented by the 
in call data records; and a traffic metric objects database that system and method of the present invention; 
contains network traffic objects that correspond to network FIG. 2 shows a high-level block diagram illustrating the 
traffic data. The network objects in the network topology 5 system architecture of the present invention; 
object database may include network hardware objects that pjQ 3 shows a more detailed block diagram of the system 
correspond to hardware elements of the network, and net- architecture of FIG. 2; 

work route objects that correspond to network routes. ^ shows ^ alternative embodiment for a Network 

In a further aspect of the Invention, the method includes Topology Object Database of the present invention; 
determining whether a state change is a significant state 10 sh(JWS a ss fl owcbart illustrating the opera- 
change. For each significant state change, an expert system • t r ventioQ usi an cxamplc of a typical 
rule may be applied to produce an assessment of the sig- ^ ^ 

nificant state change, FIG. 5 shows a process flowchart illustrating the opera- 

In yet a further aspect of the invenhon, a system for ^ presenfkvention, using an example of call 

managing a telecommunications network is provided. The 13 ™ w * 

system includes a network management workstation for blocka « c on a Wltchc<i ^ ^ ,„ . . 

£uyinVa network state. The fystem also includes a HG. Sa shows a process flowchart titrating the opera- 

ne^ork ^formation receiving and processing means com- tion of an alternate /rnbodiment of the Resent invenUon, 

municating with the workstation for receiving and process- using an example of call blockage on a switched trunk; 

ing information affecting the network state. The network 20 FIG. 6 shows a screen print of a network management 

information receiving and processing means provides appa- workstation display. The screen print contains a sample data 

ratus for implementation of the methods of the present table that shows the present state of a network, including 

invention. correlated recent events; 

FIG. 7 shows another screen print of a network manage- 

FEXTURES AND ADVANTAGES 25 WOT fcstation display that has been sorted by country 

One feature of the present invention is that it provides the code; 

current state of the network, as well as historical (recent but piG. 8 shows an Object Diagram generally depicting 

past) states. objects for an object database suitable for use in the present 

A further feature of the present invention is that the M invention; 

network is represented as consisting of customers, countries, piG, 9 shows a table defining a switch object class; 

services, and other non-tangible network elements, in addi- pj G 10 snows a tabic defining a customer object class; 

tion to the physical or hardware elements such as switches nQ u ft defining a country object class; 

and multiplexing ***^™J^ Z^crvtl FIG. 12 shows a table defining an 800 service object class; 

present invention to determine customer and service 35 . 

impacts, as well as impacts to network hardware. 311(1 

II is yet a further furore of toe preset invention that an ^ »» ^^X^SvLtio,? 

inferendng engine is provided to Prelate events, to infer *• network mana 8 ement of toe mvent,0IL 

possible causes of such events, and to recommend actions to DETAILED DESCRIPTION OF THE 

be taken in response to such events. ^ EMBODIMENTS 

An advantage of the present invention is that by manag- 1. Overview 
ing the state of the network, it associates and correlates The present invention is a system and method for man- 
network events across different network domains. Such aging telecommunications networks, particularly circuit' 
domains include, but are not limited to, transmission, switched networks. The present invention provides 
switching, customer traffic, and network routing. 45 enhanced inferencing and correlation functions not found in 

A further advantage of the present invention is that conventional systems. In contrast to the "event" manage- 

improved temporal reasoning is realized by presenting the raent of conventional network management systems, the 

state of the network with every event. Instead of attempting present invention manages the "state" of the network. As 

to correlate sequential events after they have been non- used herein, "state" refers to a set of circumstances or 

sequentially reported, the present invention correlates state 50 attributes characterizing a network element (or its corre- 

changes of network elements based on programmed heuris- sponding object) at a given time, i.e., the condition of the 

tics. This eliminates the need to properly sequence alarms network element. A network element's state can be a simple, 

and events. boolean value (e.g. , in-service or out-of-service), or it can be 

Another advantage of the present invention is that infer- more complex (e.g.. in-service, but service is degraded), 

mation from various sources is presented in a manner that 55 State can be current (e.g.. a trunk group's Answer/Seizure 

provides an integrated view of the current state of the entire Ratio for the last five minute reporting period) or historical 

network. For example, all information regarding any ele- (e.g.. a list of key traffic measurements for that trunk group 

raent that is part of a particular network route is presented as for the last 24 hours). Expert system rules that correlate 

a single row in a table. events, infer sources of problems, assess impacts, and pro- 

60 vide recommendations are triggered by network state 

BRIEF DESCRIPTION OF THE DRAWINGS changes. 

The present invention is described with reference to the The present invention performs these functions by imple- 

accompanying drawings. In the drawings* like reference menting a three-tiered network management hierarchy. The 

numbers indicate identical or functionally similar elements. bottom tier is static and represents a model of the network 

Additionally, the left-most digit(s) of a reference number 65 It provides updated network topology information. The 

identifies the drawing in which the reference number first middle tier is dynamic and represents state management of 

appears. the modeled network. It provides visibility to the current 
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conditions of the network that is modeled in Che bottom tier. vides analysis and reporting based on changes in the state of 

The top tier consists of enhanced functions and intelligence. the network. Analysis consists of such enhanced functions as 

It provides analysis, reporting, inference, presentation, and event correlation and inference of the cause of events, 

recommendations for actions. Turning now to FIG. 2, a high-level block diagram is 

In a first and preferred embodiment, the inferencing and 5 shown that illustrates the architecture of the present inven- 

correlation capabilities are performed by an expert system, tion. The components of a system architecture 208 are 

The expert system performs this function by applying rules. encompassed by the broken line. A network to be managed 

and graphically presents the results in a number of ways, by the system and method of the present invention is shown 

e.g.. changing color of a route on a map or illustrating a line generally as element 202. Network Fault Information 204 

or bar graph. In an alternate embodiment, expert system 10 and Network Performance Information 206 are collected 

rules are not applied. Rather, a sweep of a network object from Network 202 by conventional mechanisms apparent to 

database is performed at regular intervals. This sweep iden- one of skill in the relevant art Network Fault Information 

tifies: (1) significant state changes of network element 204 refers to alarms, outages, and other problems. Network 

objects; (2) potentially impacted network elements using Performance Information 206 refers to traffic loads, call 

predefined relationships among the objects in the network is data, exceeded thresholds, and other data reflecting (he 

object database; and (3) impacts to the related objects. The performance of Network 202. 

impacts to the network elements are reported as a table of Network Fault Information 204 and Network Perfor- 
correlations. mance Information 206 are fed to a Network Object Data- 
State management is realized by modeling each network base 214 that is part of system architecture 208. Network 
element as an object within an object database A network 20 Object Database 214 Is built from objects rather than 
object corresponds to a network element As used herein, a records. Each object corresponds to or represents a network 
"network element" includes, but is not limited to, non- element, such as a switch, customer, country or service, 
tangible elements, such as customers, countries, and FIG. 8 shows an Object Diagram from a Computer Aided 
services, and tangible elements such as network hardware Systems Engineering tool (Paradigm Plus. Protosoft) that 
elements (e.g.. switches and multiplexing equipment). As 25 generally depicts objects for an object database suitable for 
event information is received by the system of the present use in the present invention. A preferred object database that 
invention, appropriate attributes of impacted objects are may be used is a Versant object database. One example of a 
changed to reflect the change of state of that object. The specific object definition is shown in FIG. 9. FIG. 9 shows 
current state of the network is then presented to the user on a table defining a class of objects entitled "switch." A switch 
regular intervals, as significant state changes occur, or on 30 object is a network hardware object that corresponds to a 
user demand. Impacts of these events, such as customer hardware element of the network, particularly a stored 
outages or blocked traffic routes, can also be determined and program machine, such as a computer, that connects and 
presented. The system of the present invention also has the determines the routing of calls. FIG. 9 shows how switch 
ability to present impacts of network controls and corrective objects relate to other network elements and their cone- 
actions immediately after they are implemented. 35 speeding objects. As shown in FIG. 9. the switch class is a 
The present invention allows network management per- subclass of '"Equipment** The definition also includes a set 
sonnel to monitor and analyze various data collected from of attributes (e.g., "vendor" or "model number**). The behav- 
several different sources of the network that is presented in iar component of this object class is identified by the 
a simple, integrated fashion. It provides automated functions operations ("set** and "get**). The relationships with other 
that were previously done manually, such as correlating 40 objects are also identified (e.g.. "Trunk Group** and "Port"), 
network events and inferring possible causes of such events. As another example. FIG. 10 shows a table defining a 
Hie present invention achieves these results by presenting class of objects entitled "customer." A customer object 
the state of the network, and how that state changes with corresponds to a non-tangible network element, particularly 
events, rather than just reporting the occurrence of the an entity that uses services. As shown in FIG. 10. the 
events. 45 customer class is a superclass of other classes (e.g., "Resi- 
2. System Description dentiaT or "General Business**). FIG. 10 illustrates the 
With reference to FIG. 1, a block diagram is shown that relationship and attribute definition for customer objects, 
illustrates the three-tiered network management hierarchy For example, a customer object has "name" and "customer 
implemented by the system and method of the present id" attributes. A customer object relates to "Service", 
invention. The bottom fundamental tier is a static network so ,4 Organization* t . and "Country" objects. A "Country" class of 
topology tier 102 that contains a model of the entire net- objects is defined in the table shown in FIG. 11 FIG. 11 
work. Her 102 provides static information regarding the shows the relationship to customer objects, 
topology and design of the network. Although this informa- An example of a service class of objects is shown in FIG. 
tion is static in relation to network events, it is updated 12. FIG. 12 shows a table defining a class of objects entitled 
regularly as the topology of the network changes. ss "800 Service" in which the called party is the billable 
A middle dynamic state management tier 104 is built over customer. The 800 Service class is a subclass of "Service" 
network topology tier 102. State management tier 104 that relates to "Customer" objects. FIG. 12 illustrates the 
consists of dynamic informatioa relating to events that occur relationship and attribute definition for 800 Service objects, 
in or impact the network. The present invention reflects Each object is defined by a set of attributes, the values of 
changes in state of various elements of the network through 60 which reflect the current state of the corresponding network 
state management tier 104. State management tier 104 also element As event information is received from Network 
provides visibility to the current state of the entire network. 202, network elements that are impacted by the event 
The implementation of state management tier 104 marks a (impacted network elements) are identified by their corre- 
significant difference from the event management of con- spending object as impacted network objects. Appropriate 
vendonal network management systems. 65 attributes of each object are identified as impacted attributes. 

A top intelligence, analysis, and reporting tier 106 is built The values of impacted attributes arc then changed to reflect 

over the middle state management tier 104. Her 106 pro- the impact of the event The changed attributes then rcpre- 
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sent the updated current stale of that object. This process of are adequately identified, and that the appropriate attributes 

identifying impacted network objects and changing the of each impacted object are properly updated, 

values of impacted attributes is represented in dynamic state As an alternative embodiment. Network Topology Object 

management tier 104 shown in FIG. 1. Database 318 may be partitioned into two databases, as 

Referring again to FIG. 2, Network Object Database 214 5 shown in FIG. 3a. A Network Topology Object Database 
is populated with input from a Network Database, shown 318c contains objects and object relationships identifying 
generally at 210. This database is a conventional source of each network element and its relationship to other elements, 
data that an enterprise uses to build its network. Network A Network State Object Database 3186 contains Network 
database 210 contains data that represent the current State Objects representing the dynamic state of each net- 
topology, structure, routing, and capacity of the network. 10 work element. Each network element object in Network 
These data are fed to Network Object Database 214 via a Topology Object Database 318a is linked to a network state 
Database Server 212. A preferred database server for use object in Network State Object Database 3186, which pro- 
with the present invention is a Sybase OMNI SQL Server. vides the current state of that network element. Each net- 
The data are processed to represent each element as an work state object is defined by a set of network state 
object which is then entered into Network Object Database 15 attributes that represent the dynamic state of the correspond- 
214. Data is periodically provided to Network Object Data- ing network object As an example, an object representing 
base 214 to maintain a current view of network topology. network element Trunk Group 1234 is contained in Network 
This process of updating network objects to maintain a Topology Object Database 318a. Attributes of this object 
current view of network topology and architecture isrepre- may include switch/port #1 identifier, switch/port #2 
sented in static network topology tier 102 shown in FIG. 1. 20 identifier, number of circuits, and type of service supported 

An Inferencing Engine 218 communicates with Network by the Trunk Group. Also contained within this object is a 

Object Database 214 to provide intelligence capabilities. A pointer to a state object contained within Network State 

particularly preferred Inferencing Engine 218 is Talarian's Object Database 3186. This state object may include an 

RXWorks Expert System. Inferencing Engine 218 is pro- attribute whose value indicates Trunk Group 1234 is cur- 

grammed with rules and heuristics that are used to induce 25 rently experiencing complete blockage on 15% of its cir- 

and deduce results of events that are input to Network Object cuits. 

Database 214. This provides the inferencing and correlation The second object database that makes up Network 
capabilities of the present invention. As impacted attributes Object Database 214 is a Call Data Object Database 316. 
are changed in response to events, a change in state to Call Data Object Database 316 collects Network Call Data 
corresponding elements is registered. If such a stale change 30 Records 304 from Network 202 and converts them into call 
is deemed significant a notification message is issued to data objects. Call Data Records are also referred to as Call 
Inferencing Engine 218. This notification message triggers Detail Records (CDR). CDR data, such as originating ANIs 
rules in Inferencing Engine 218 that are appUed to perform (Automatic Number Identifiers) and service types, builds 
enhanced functions. These functions include event and modifies call data siunmary objects in Call Data Object 
correlation, impact assessments, problem inference, and 35 Database 316. These call data summary objects are linked to 
action recommendation. These intelligence functions are network element objects in Network Topology Object Data- 
represented in intelligence, analysis, and reporting tier 106 base 318 via pre-defined relationships. These relationships 
shown in FIG. 1. provide an association between network elements and CDR- 
Processed data, reflecting recent (historical) and current based performance data that pertain to the associated net- 
states of network elements, are collected by a Presentation 40 work elements. 

Manager 216. These data are formatted into tables, graphs. The third object database that makes up Network Object 

or maps that show the correlation of events. The data are Database 214 is a Traffic Metrics Object Database 320. 

transmitted to a Network Management Workstation 220 for Traffic Metrics Object Database 320 collects Network Traf- 

presentation and display. Network management personnel flc Statistics 310 that originate on Network 202 and converts 

who use workstation 220 can then view current and previous 45 them into network traffic objects. These statistics represent 

states of the entire network customer traffic loads on each trunk and switch in the 

FIG. 3 shows a more detailed block diagram of the system network. They reflect the performance of the network, and 

architecture of FIG. 2. Network Object Database 214 shown include such data as call attempts, call completions, call 

in FIG. 2 is comprised of three object databases. The three blocking percentages, trunk utilization and switch utiliza- 

object databases shown in FIG. 2 for Network Object so tion. Network traffic objects are related to network element 

Database 214 are illustrative, and the present invention is not objects in Network Topology Object Database 318. These 

limited to use of such databases for Network Object Data- relationships provide an association between network ele- 

base 214. It is to be understood that Network Object meats and network traffic statistics to reflect the impact of 

Database 214 could contain any number of other object network traffic on the associated network elements, 

databases. The first is a Network Topology Object Database 53 Network Database 210 is partitioned into a Network 

318 that contains objects that represent network elements. Topology Database 322 and a Network Routing Database 

The attributes of each object represent the present state of 324. Network Topology Database 322 contains data that 

the network element corresponding to that object These specify the structure, topology, architecture, and capacity of 

attributes are changed by events that are received by Net- Network 202. Network Routing Database 324 contains data 

work Object Database 214. As shown in FIG. 3, such events 60 that specify logical routes and paths of traffic, as well as 

include Network Alaims 306 and Network Outage Informa- connections to various destinations. The data of Network 

tion 308. This information is collected from Network 202 Topology Database 322 and Network Routing Database 324 

and input to a Network Event Parser 314. are periodically input to Network Topology Object Database 

Network Event Parser 314 serves as a gateway for event 318 via Database Server 212. For example, as changes to the 
data. Network Event Parser 314 parses and formats the data 65 design of Network 202 are implemented, the data in Net- 
to be uploaded to Network Topology Object Database 318. work Topology Database 322 and Network Routing Data- 
This ensures mat objects that are impacted by a certain event base 324 are changed to reflect the new design. These data 
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are then fed via Database Server 212 to Network Topology 
Object Database 318. Network Topology Object Database 
318 updates impacted attributes of objects impacted by the 
design change. This maintains a current view of network 
topology. 

One example of Inferencing Engine 218 is an Expert 
System 326. Expert System 326 interfaces with Network 
Topology Object Database 318 to provide the functions that 
constitute intelligence tier 106. Expert System 326 reads 
state changes from Network Topology Object Database 318. 
Based on these state changes. Expert System 326 applies 
appropriate rules that correlate various events and infer 
possible root causes of events to produce an assessment of 
the events. The assessment containing the results of such 
correlation and inference, is provided to Presentation Man- 
ager 216 to format for presentation. Expert System 326 can 
also provide a recommendation on corrective action or 
network controls to Network Topology Object Database 
318. and can then monitor the impact of such controls to 
determine when to remove them. The impact of such rec- 
ommended corrective actions are applied to impacted 
objects. The resulting state changes are then provided to 
Presentation Manager 216 to format for presentation. 

As an alternative to using Expert System 326, correlation 
may be performed by auditing Network Topology Object 25 
Database 318, or Network State Object Database 3182) if mat 
embodiment is used, at periodic intervals. This audit is 
performed to identify significant changes in the stale of 
network element objects. If such a significant state change is 
identified, all related network elements are then identified 30 
via pre-defined network element object relationships. These 
relationships are defined and maintained in Network Topol- 
ogy Object Database 318, and are based on actual network 
topology. Impacts to states of the related network elements 
are then assessed, and changes in states of all related 35 
network elements are correlated and reported to the user via 
a table of correlations. 

Presentation Manager 216 receives data from Expert 
System 326 and from each of databases 316. 318, and 320. 
These data represent updated states of Network 202. net- 40 
work events, network performance, correlation of events, 
inferred causes of events, impacts of events, and recom- 
mended actions. Presentation Manager 216 formats these 
data into tables, graphs, or maps so that they are presented 
to a user, such as network management personnel, in a dear 45 
and useful manner. Presentation Manager 216 provides the 
formatted data to Network Management Workstation 220. 
for viewing by network management personnel. For 
example, assume a DS-3 outage event occurs, and several 
alarms are received mat are correlated to that DS-3 outage 50 
event. This network event information is received and 
processed, and the data formatted so that the DS-3 outage 
event all correlated events, and all impacted network ele- 
ments are presented as correlated. This presentation may be 
as a table with correlated events appearing on a single row, 
as a bar or line graph representing the impacts of correlated 
events, as a route map showing correlated events in specific 
colors or patterns, or other methods apparent to those skilled 
in the relevant arts. This allows the user to see all reported 
and filtered events related to the DS-3 outage event This 
assists network management personnel in determining the 
appropriate controls and corrective action. 

An example of a screen print of a network management 
workstation display is shown in FIG. 6. In the embodiment 
shown in FIG. 6. Expert System 326 is not used. Rather, 
event correlation is performed by sweeping the network 
object database. The screen print contains a sample data 



table that shows the present state of a network, including 
correlated recent events. Each row in the table represents a 
route to a specific country and destination switch, which are 
identified in the first column. Other columns represent the 
country code (CCode) for that country, the originating 
switch that serves it, and a route number. The remainder of 
the row presents a series of statistics that reflect the current 
state of that route. In the embodiment of FIG. 6. these 
include: 



Element Modified 

by this Stale Element State Description 



Route % ASR 



Route or Think 
Group 



Destination % ASR Switch- to-Counlry 
relationship or link 



Destination % 
OVFL 

Signal Failure 



B -Category EOS 
(End-tf -Selection) 



B-Cat % Failure 



Cite Blocked/Total 



Transmission Out 
DS3 End Point 



Transmission Out 
Break Point 



Switch- to-Country 
relationship or link 

Switch- to-Signal 
Point relationship 
or link 

Route or Trunk 
Group 



Route or Trunk 
Group 



Route or Trunk 
□roup 

DS3 



The call attempt Answer/ 
Seizure Ratio (ASR) of a 
particular route. 
The ASR percentage to a 
country as reported by a 
particular switch. 
The traffic overflow percent- 
age to a country as reported 
by a particular switch. 
Loss of signaling capability to 
a remote switching center as 
reported by a particular 



DS3 



Type 



Transmission 
Segment 



The category of failure for 
call attempts on a route which 
have railed during a recent 
time interval. 
The percentage of call at- 
tempts co a route which have 
failed during a recent time 
interval. 

The number of circuits 
blocked over the total number 
of circuits on that trunk group. 
loVnirfirs particular DS3 for 
which impacts have been 
reported or assessed. 
Identifies station pair on DS3 
between which impacts have 
been reported or assessed. 
Identifies technology (e.g., 
fiber optic or digital radio) of 
transmission segment on 
which impacts have been re- 
ported or assessed. 



55 



60 



65 



By placing all state data in a single row. the results of the 
correlation processing by the present invention is presented 
to the user. This enables network management personnel to 
formulate a clearer picture of what is happening in a 
particular portion of the network, including causes and 
impacts of events. 

Another example of a screen print of a network manage- 
ment workstation display is shown in FIG. 7. In FIG. 7, 
information lines have been sorted by country code. For 
example, all information for the United Kingdom has been 
grouped together, even though the information was reported 
by more than one gateway. This feature assists network 
management personnel in identifying systematic network 
events that impact more than one gateway, such as a 
transoceanic cable outage. 

In the alternative embodiment of the invention, in which 
Expert System 326 is not used, the display of network state 
information is refreshed every two minutes, "sweeping 
through* 1 Network Topology Object Database 318. The state 
of any particular network element persists until it is cleared 
by a subsequent state change. 

An exemplary computer system 1302 for use in the 
network management system of the present invention is 
shown in FIG. 13. In a preferred embodiment computer 
system 1302 is an IBM RS/6000. Computer System 1302 
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implements System Architecture 208 by receiving and pro- Network Topology Object Database 318. The state of the 

cessing network information. Computer System 1302 pro- segment XYZ is updated in a step 408. The event attributes 

vides data to Network Management Workstation 220. Com- of the event object created in step 404 are used to control the 

puter System 1302 includes one or more processors, such as changes made to the impacted attributes of the XYZ object 

processor 1304. Processor 1304 is connected to a comrau- 5 By changing the value of the impacted attributes of the XYZ 

nication bus 1306. Computer System 1302 may communi- object, the state of the transmission segment XYZ is 

cate with other similarly configured computer systems or changed. 

with Network Management Workstation 220 via a network In a step 410, a state filter is used to determine if the state 

I3jg change of transmission segment XYZ is significant enough 

Computer system 1302 also includes a main memory 10 to report This process eliminates reporting of several trivial 

im i^crably random access memory (RAM), and a events mat may occur, such as a ne^kmcrease in caU 

V v ' v : , . blockage. The state filter of step 410 may be implemented 

secondary J^ory 1310 f^^^^^^ tough discrimination rules inWork Topol^Y Object 

for examp e. a hard disk drive 1312 and/or a ^able ^ discrimination rules are included in the 

storage drive 1314. represent* object ^ton or registration. For example, in the defini- 

magnetic tape drive, a compact disk dnye, etc. Reraovab e 15 g netW0fk route object ^ corresponds to a network 

storage drive 1314 reads from and/or writes to a removable roufc a ^ ^ ^ written to notify if a route attribute 

storage unit 1316 in a well known manner. changes. Alternatively, a discrimination rule can be written 

Removable storage unit 1316, also called a program to notify onl y ^ me routc at nibute changes in a particular 
storage device or a computer program product represents a wav j c a significant state change. Alternatively, the state 
floppy disk, magnetic tape, compact disk. etc. As will be ^ fij^er of step 410 may be implemented through rules con- 
appreciated, removable storage unit 1316 includes a com- tained in Inferencing Engine 218. or Expert System 326. 
puter usable storage medium having stored therein computer if the state filter determines the state change is not 
software and/or data. significant the process ends as indicated in a step 412, and 

Computer programs (also called computer control logic) the state change does not get reported or assessed. If the state 

are stored in main memory and/or secondary memory 1310. 25 filter determines the state change is significant the process 

Such computer programs, when executed, enable computer proceeds to a step 414, in which a notification message of the 

system 1302 to perform the features of the present invention XYZ state change is generated. This message defines how 

as discussed herein. In particular, the computer programs. the state of XYZ was changed so that the impact can be 

when executed, enable processor 1304 to perform the fea- determined. In a step 416, the state change notification 

tures of the present invention. Accordingly, such computer 30 message * W™<** A message manager reads die notifica- 

programs re£Lnt controllers of computer system 1302. *» ~* from »" forwards 11 to 

In an alternate embodiment, the invention is directed to a » ^ert System 326 reads the notification 

computer program product comprising a computer readable m e ^ d ^^the appropriate rules to assess the 

medium having control logic (computer software) stored im p a cf 0 fthe state change, as well as to associate or correlate 

therein. The control logic, when executed by processor 35 ^ state change with other state changes. These rules, as 

1304. causes processor 1304 to perform the functions of the app ij e d by Expert System 326, are based on programmed 

invention as described herein. heuristics that define how network entities are related, how 

When network event information (such as one of the m impacted by various events, and how they behave, 

alarms in Network Alarms 306) is received, the network xn this particular example. Expert System 326 applies or 

event information is processed to answer three basic inquir- ^ carries out the rules identified in steps 422-428. Expert 

ies: System 326 examines the links in Network Topology Object 

(1) what objects are impacted by this network event Database 318 between transmission segment XYZ and each 
information; of the switched trunks to determine which switched trunks 

(2) what attributes of each impacted object are impacted traverse segment XYZ. Expert System 326 also queries the 
by this network event information; and 45 state of each switched trunk to determine if any of them are 

(3) to what value should each impacted attribute be in a blocked state. This determination is made in a step 422 
changed to reflect the impact of the network event to identify switched trunks that may be blocked as a result 
information. of the fiber cut in transmission segment XYZ. 

These same inquiries are made when network topology If no switched trunks in a blocked state are found to 

information is received from Network Database 210 regard- so traverse segment XYZ, the process ends as indicated in a 

ing network topology and routing. The operation of the step 424. However, if such trunks are found, they are 

present invention is illustrated in the following examples. identified in a step 426, Le., identify all switched trunks in 

3. Examples a blocked state that traverse segment XYZ. These data are 

Referring to FIG. 4, a process flowchart is shown that presented via Presentation Manager 216 to notify the users 

illustrates how the present invention operates in response to 55 of the determined correlation between the XYZ segment 

a typical network event, a transmission fiber cut, A fiber cut outage and the blocked trunks, as indicated in a step 428. 

generates an alarm from a network that indicates which The process of FIG. 4 illustrates how the present inven- 

transmission segment is out-of-service in a step 402. The tion correlates network events. In step 420. the state of each 

alarm is generated and the associated data are provided via switched trunk in Network Topology Object Database 318 is 

conventional network mechanisms. In this example, the 60 queried to determine which trunks are being blocked. This 

impacted transmission segment is identified as XYZ, which query is necessary to correlate the XYZ transmission seg- 

may represent a segment of fiber between two optical ment outage to blocked trunks. 

repeaters or terminals. A further example of how the present invention correlates 

When the alarm data are received, the data are parsed by network events through state management is provided in 

Network Event Parser 314, and an object representing the 63 FIG. 5. The process of identifying blocked trunks and 

event is created in a step 404. In a step 406. the network correlating them to a transmission outage is illustrated in 

object representing transmission segment XYZ is located in FIG. 5. 
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When a certain threshold of trunk blockage is exceeded 
a network switch generates an alarm indicating trunks on a 
trunk group are blocked, as shown in a step 502. The alarm 
is generated and the associated data are provided via con- 
ventional network mechanisms. In this particular example, 5 
the trunk group experiencing blockage is identified as 123 
for illustrative purposes. 

When the alarm data are received, the data are parsed by 
Network Event Parser 314. and an object representing the 
event is created in a step 504. In a step 506. the network 10 
object representing trunk group 123 is located in Network 
Topology Object Database 318. The state of the trunk group 
123 is updated in a step 508. The event attributes of the event 
object created in step 504 are used to control the changes 
made to the impacted attributes of the 123 object By 15 
changing the impacted attributes of the 123 object the state 
of the trunk group 123 is changed. 

In a step 510, a state filter is used to determine if the state 
change of trunk group 123 is significant enough to report 
This process eliminates reporting of several trivial events 20 
mat may occur, such as a negligible increase in call block- 
age. In a manner similar to that of step 410. the state filter 
of step 510 may be implemented through discrimination 
rules in Network Topology Object Database 318, Inferenc- 
ing Engine 218, or Expert System 326. 25 

If the state filter determines the state change is not 
significant the process ends as indicated in a step 512. and 
the state change does not get reported or assessed. If the state 
niter determines the state change is significant, the process 
proceeds to a step 514, in which a notification message of the 30 
123 state change is generated. This message defines how the 
state of 123 was changed so that the impact can be deter- 
mined. In a step 516. the state change notification message 
is queued. A message manager reads the notification mes- 
sage from the queue, and forwards it to Expert System 326 35 
in a step 518. The process up to this point parallels the one 
illustrated in FIG. 4. 

In a step 520. Expert System 326 reads the notification 
message and applies the appr o priate rule to assess the impact 
of the state change, as well as to associate or correlate this 40 
state change with other state changes. In this example, one 
of these other state changes may be the transmission outage 
identified in FIG. 4. 

As in FIG. 4. the rules applied by Expert System 326 in 
step 520 are based on programmed heuristics mat define 45 
how network entities are related, how they are impacted by 
various events, and how they behave. In this particular 
example. Expert System 326 applies or carries out the rules 
identified in steps 522-528. Expert System 326 examines 
the links in Network Topology Object Database 318 between 30 
trunk group 123 and each of the transmission segments that 
trunk group 123 traverses. Expert System 326 also queries 
the state of each transmission segment to determine if any of 
them are in an out-of- service state. This determination is 
made in a step 522. If no segments are found to be in a state 55 
of degraded service, the process ends as indicted in a step 
524. 

If a problem is found od any transmission segment 
traversed by trunk group 123, the segment is identified in a 
step 526. These data are presented via Presentation Manager 60 
216 to notify the users of the determined correlation between 
the trunk group 123 blockage and the degraded or out-of- 
service state of each transmission, as indicated in a step 528. 

The difference in the processes of FIGS. 4 and 5 illustrates 
one advantage of the present invention, i.e., its ability to 65 
perform event correlation without regard to the domain from 
which the notifications are received. For example, in FIG. 4. 
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notification (step 402) is received from the transmission 
domain, while in FIG. 5. notification (step 502) is received 
from a different domain (switching). Although notification is 
received from different domains, the same event correlation 
is performed (steps 426/428 and steps 526/528). 

FIG. 5a illustrates how events are correlated without the 
use of Expert System 326. as can be done in an alternative 
embodiment of the present invention. The process operates 
the same as in FIG. 5 through step 508. in which the object 
representing the state of Trunk Group 123 is updated in 
accordance with the Event Object. In a step 509. Network 
Topology Object Database 318 is examined to identify all 
Network Element Objects which have a defined relationship 
with the Trunk Group 123 object Network elements are 
related via their actual network topology, and these relation- 
ships are represented by object linkage within Network 
Topology Object Database 318. In this example, related 
network elements will include the various transmission 
segments that Trunk Group 123 traverses. 

In a step 511, the State Objects that are linked to each 
Network Element Object examined in step 509 are them- 
selves examined to detect any change in element state. These 
State Objects represent the state of Network Element 
Objects. 

The examination of Network Topology Object Database 
318 that occurs in step 509 is performed for all Network 
Element Objects that have been updated. The related Net- 
work Element Objects for each such updated Network 
Element Object are identified and examined in step 509. The 
State Objects for each such related Network Element 
Objects are then examined in step 511. This examination of 
Network Topology Object Database 318 is performed at 
regular periodic intervals. Thus, in a step 513, the process 
that occurs in steps 509 and 511 repeats; the process loop 
farmed by steps 509, 511. and 513 runs continuously. The 
example illustrated in FIG. 5a uses processing on Trunk 
Group 123 as a single example. 

If any state change of Trunk Group 123-related network 
elements is detected in step 511. then in a step 515 it is 
determined if there is a problem related to any transmission 
segment that was examined in steps 509 and 511. Again, the 
use of ^transmission segment** is for the example of Trunk 
Group 123. Such an examination and determination is 
performed for all updated Network Element Objects and 
related Network Element Objects. 

If a problem with a related transmission segment is 
detected in step 515, then in a step 517 the association 
between the Trunk Group 123 blockage and the transmission 
segment problem is presented to the user. This presentation 
is via Presentation Manager 216 and Network Management 
Workstation 220. The association may be presented in a 
number of ways, such as a table of correlations. 

If no problem is detected in step 515. then no such 
presentation is made, and this segment of the process ends 
in a step 519. Of course, the process loop represented in 
steps 509. 511. and 513 executes continuously. 
4. Conclusion 

While various embodiments of the present invention have 
been described above, it should be understood that they have 
been presented by way of example only, and not limitation. 
The present invention can be used to manage networks of 
any scale, e.g., domestic, regional, international, global, etc. 
The present invention can also be configured for standards- 
based exchange using such standards as Open-Systems 
Interconnection (OSI) or Telecommunication Management 
Network (TMN). The present invention is not limited to 
management of a telecommunications network, and can be 
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used in other industries. For example, the present invention 
could be used in the financial services industry. The present 
invention could be used, for example, to monitor credit card 
usage and provide notification for a pattern of unusual credit 
card usage. Thus, the breadth and scope of the present 5 
invention should not be limited by any of the above- 
described exemplary embodiments, but should be defined 
only in accordance with the following claims and their 
equivalents. 

What is claimed is: i° 

1. A method for managing a telecommunications network, 
comprising: 

(1) maintaining a network object database comprising a 
plurality of network objects, wherein each of said 
network objects corresponds to at least one of a plu- 15 
rality of network elements, said plurality of network 
elements including tangible network elements and non- 
tangible network elements, wherein each of said net- 
work objects is defined by a set of attributes, each of 
said attributes having a value that represents a current 20 
state of the corresponding network element; 

(2) receiving network event information from a plurality 
of network domains; 

(3) identifying each of said network objects that is ^ 
impacted by said network event information as 
impacted network objects, wherein said impacted net- 
work objects correspond to impacted network ele- 
ments; 

(4) identifying each of said attributes of said impacted 30 
network objects that is impacted by said network event 
information as impacted attributes; 

(5) changing the value of said impacted attributes to 
reflect the impact of said network event information, 
thereby updating the current state of said impacted 35 
network elements to incorporate a state change and 
correlating network event information from at least one 
network domain with state changes in said at least one 
network domain and other network domains; and 

(6) providing data reflecting the current state of said 40 
network elements and the updated current state of said 
impacted network elements to a network management 
workstation. 

2. The method of claim 1. wherein step (t) further 
comprises: 45 

(a) maintaining a network topology object database con- 
taining said network objects; 

(b) maintaining a call data object database containing a 
plurality of call data objects, wherein each of said call ^ 
data objects is defined by a set of call data attributes 
that correspond to data contained in network call data 
records; and 

(c) maintaining a traffic metrics object database contain- 
ing a plurality of network traffic objects, wherein each M 
of said network traffic objects is defined by a set of 
network traffic attributes that corresponds to network 
traffic data. 

3. The method of claim 2, wherein step (2) further 
comprises: ^ 



(a) parsing said network event urformation to identify an 
event; and 

(b) creating an event object defined by a set of event 
object attributes that corresponds to said event 

4. The method of claim 3, further comprising: 65 

(c) repeating steps (a) and (b) for each event contained in 
said network event information. 



5. The method of claim 3, wherein said network event 
information comprises network alarms and network outage 
information. 

6. The method of claim 3. wherein said event object 
attributes are used in step (5) to change the value of said 
impacted attributes to update the current state of said 
impacted network elements. 

7. The method of claim 6, wherein said call data attributes 
and said network traffic attributes are used in step (5) to 
change the value of said impacted attributes to update the 
current state of said impacted network elements. 

8. The method of claim 2, wherein said call data attributes 
are used in step (5) to change the value of said impacted 
attributes to update the current state of said impacted net- 
work elements. 

9. The method of claim 2, wherein said network traffic 
attributes are used in step (5) to change the value of said 
impacted attributes to update the current state of said 
impacted network elements. 

1&. The method of claim 2, wherein said network objects 
in said network topology object database comprise: 

network customer objects defined by a set of network 
customer attributes that correspond to network custom- 
ers; 

network country objects defined by a set of network 

country attributes that correspond to countries served 

by the network; and 
network service objects defined by a set of network 

service attributes that correspond to services performed 

by the network. 

11. The method of claim 10, wherein said network objects 
in said network topology object database further comprise: 

network hardware objects defined by a set of network 
hardware attributes that correspond to hardware ele- 
ments of the network. 

12. The method of claim 11, wherein said network objects 
in said network topology object database further comprise: 

network route objects defined by a set of network route 
attributes that correspond to network routes. 

13. The method of claim 12, further comprising: 

(7) receiving notification of a route change to said net- 
work routes; 

(8) identifying each of said network route objects that is 
impacted by said route change as impacted network 
route objects; 

(9) identifying each of said network route attributes of 
said impacted network route objects that is impacted by 
said route change as impacted network route attributes; 

(10) changing the value of said impacted network route 
attributes to reflect the impact of said route change. 

14. The method of claim 11, further comprising: 

(7) receiving notification of a hardware change to said 
hardware elements of the network; 

(8) identifying each of said network hardware objects that 
is impacted by said hardware change as impacted 
network hardware objects; 

(9) identifying each of said network hardware attributes of 
said impacted network hardware objects that is 
impacted by said hardware change as impacted network 
hardware attributes; 

(10) changing the value of said impacted network hard- 
ware attributes to reflect the impact of said hardware 
change. 

15. The method of claim 1, further comprising: 
(7) for each of said impacted network elements, deter- 
mining whether said state change is a significant state 
change; and 
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(8) sending a notification message to said network man- 
agement workstation for each significant state change. 

16. The method of claim 2, wherein step (IX*) comprises: 
(i) maintaining a network state object database containing 

a plurality of network state objects, wherein each of 3 
said network state object is linked to a corresponding 
network object 

17. The method of claim 16, wherein each of said network 
state objects is defined by a set of network state attributes 
that represent the dynamic state of the corresponding net- 10 
work object 

18. The method of claim 10. wherein said network cus- 
tomer objects have a predefined relationship to said network 
country objects and to said network service objects. 

19. The method of claim 1, wherein said plurality of 15 
network domains comprises transmission, switching, cus- 
tomer traffic, and network routing domains. 

20. A method for managing a telecommunications 
network, comprising: 

(1) maintaining a network topology object database com- 
prising a plurality of network objects, wherein each of 
said network objects corresponds to at least one of a 
plurality of network elements, said plurality of network 
elements including tangible network elements and non- 
tangible network elements, wherein each of said net- 
work objects is defined by a set of attributes, each of 
said attributes having a value that represents a current 
state of the corresponding network element; 

(2) receiving network event information from a plurality ^ 
of network domains; 

(3) receiving network topology information; 

(4) identifying each of said network objects that is 
impacted by said network event information, and each 
of said network objects that is impacted by said net- 35 
work topology information, as impacted network 
objects, wherein said impacted network objects corre- 
spond to impacted network elements; 

(5) identifying each of said attributes of said impacted 
network objects that is impacted by said network event 40 
information and said network topology information as 
impacted attributes; 

(6) changing the value of said impacted attributes to 
reflect the impact of said network event information 
and said network topology information, thereby updat- 
ing the current state of said impacted network elements 
to incorporate a state change and correlating network 
event information from at least one network domain 
with state changes in said at least one network domain 
and other network domains; 

(7) for each of said impacted network elements, deter- 
mining whether said state change is a significant state 
change; 

(8) for each significant state change, applying an expert 55 
system rule to produce an assessment of said significant 
state change and providing said assessment to a net- 
work management workstation; and 

(9) providing data reflecting the current state of said 
network elements and the updated current state of said $o 
impacted network elements to the network manage- 
ment workstation. 

21. The method of claim 20, further comprising: 

(10) maintaining a call data object database containing a 
plurality of call data objects, wherein each of said call 65 
data objects is defined by a set of call data attributes 
that correspond to data contained in network call data 
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records, wherein said call data attributes are used in 
step (6) to change the value of said impacted attributes 
to update the current state of said impacted network 
elements. 

22. The method of claim 20, further comprising: 
(10) maintaining a traffic metrics object database contain- 
ing a plurality of network traffic objects, wherein each 
of said network traffic objects is defined by a set of 
network traffic attributes that correspond to network 
traffic data, wherein said network traffic attributes are 
used in step (6) to change the value of said impacted 
attributes to update the current state of said impacted 
network elements. 

23. The method of claim 20. wherein step (2) further 
comprises: 

(a) parsing said network event information to identify an 
event; and 

(b) creating an event object defined by a set of event 
object attributes that correspond to said event 

24. The method of claim 20. wherein said network objects 
in said network topology object database comprise: 

network customer objects defined by a set of network 
customer attributes that correspond to network custom- 
ers; 

network country objects defined by a set of network 

country attributes that correspond to countries served 

by the network; and 
network service objects defined by a set of network 

service attributes that correspond to services performed 

by the network. 

25. The method of claim 24, wherein said network objects 
in said network topology object database further comprise: 

network hardware objects defined by a set of network 
hardware attributes that correspond to hardware ele- 
ments of the network. 

26. The method of claim 25. wherein said network objects 
in said network topology object database further comprise: 

network route objects defined by a set of network route 
attributes that correspond to network routes. 

27. The method of claim 26. wherein said network topol- 
ogy information comprises a route change to said network 
routes, further comprising: 

(10) identifying each of said network route objects that is 
Impacted by said route change as impacted network 
route objects; 

(11) identifying each of said network route attributes of 
said impacted network route objects that is impacted by 
said route change as impacted network route attributes; 

(12) changing the value of said impacted network route 
attributes to reflect the impact of said route change. 

28. The method of claim 25, wherein said network topol- 
ogy information comprises a hardware change to said hard- 
ware elements of the network, further comprising: 

(10) identifying each of said network hardware objects 
that is impacted by said hardware change as impacted 
network hardware objects; 

(11) identifying each of said network hardware attributes 
of said impacted network hardware objects that is 
impacted by said hardware change as impacted network 
hardware attributes; 

(12) changing the value of said impacted network hard- 
ware attributes to reflect the impact of said hardware 
change. 

29. The method of claim 24. wherein said network cus- 
tomer objects have a predefined relationship to said network 
country objects and to said network service objects. 
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30. The method of claim 20, wherein said plurality of 
network domains comprises transmission, switching, cus- 
tomer traffic, and network routing domains. 

31. A system for managing a telecommunications 
network, comprising: 

a network management workstation for displaying a net- 
work state; and 

network information receiving and processing means 
communicatively coupled to said network management 
workstation for receiving and processing information 
affecting the network state, said network information 
receiving and processing means comprising. 

database maintenance means for maintaining a network 
topology object database comprising a plurality of 
network objects, wherein each of said network objects 
corresponds to at least one of a plurality of network 
elements, said plurality of network elements including 
tangible network elements and non-tangible network 
elements, wherein each of said network objects is 
defined by a set of attributes, each of said attributes 
having a value that represents a current state of the 
corresponding network element 

event receiving means for receiving network event infor- 
mation from a plurality of network domains. 

topology receiving means for receiving network topology 
information, 

means for identifying each of said network objects that is 
impacted by said network event information, and each 
of said network objects mat is impacted by said net- 
work topology information, as impacted network 
objects, wherein said impacted network objects corre- 
spond to impacted network elements, 

means for identifying each of said attributes of said 
impacted network objects that is impacted by said 
network event information and said network topology 
information as impacted attributes, 

means for changing the value of said impacted attributes 
to reflect the impact of said network event information 
and said network topology information, thereby updat- 
ing the current state of said impacted network elements 
to incorporate a state change and correlating network 
event information from at least one network domain 
with state changes in said at least one network domain 
and other network domains, 

means for determining whether said state change is a 
significant state change. 

means for applying an expert system rule to produce an 
assessment of said significant state change. 

means for transmitting said assessment to said network 
management workstation, and 

means for transmitting data reflecting the current state of 
said network elements and the updated current state of 
said impacted network elements to said network man- 55 
agement workstation. 

32. The system of claim 31, wherein said network infor- 
mation receiving and processing means further comprises: 

means for maintaining a call data object database con- 
taining a plurality of call data objects, wherein each of 60 
said call data objects is defined by a set of call data 
attributes that correspond to data contained in network 
call data records. 

33. The system of claim 31. wherein said network infor- 
mation receiving and processing means further comprises: 

means for maintaining a traffic metrics object database 
containing a plurality of network traffic objects. 
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wherein each of said network traffic objects is defined 
by a set of network traffic attributes that correspond to 
network traffic data. 

34. The system of claim 31, wherein said network infor- 
mation receiving and processing means further comprises: 

means for parsing said network event information to 

identify an event; and 
means for creating an event object defined by a set of 

event object attributes that correspond to said event 

35. The system of claim 31, wherein said network infor- 
mation receiving and processing means further comprises: 

means for generating a notification message for said 
significant state change, wherein said notification mes- 
sage triggers said means for applying to produce said 
assessment of said significant state change. 

36. The system of claim 31, wherein said plurality of 
network domains comprises transmission, switching, cus- 
tomer traffic, and network routing domains. 

37. A computer program product comprising a computer 
useable medium having computer program logic recorded 
thereon for enabling a processor in a computer system to 
manage a teleconimuiiication s network, said computer pro- 
gram logic comprising: 

database maintenance means for enabling the processor to 
maintain a network topology object database compris- 
ing a plurality of network objects, wherein each of said 
network objects corresponds to at least one of a plu- 
rality of network elements, said plurality of network 
elements including tangible network elements and non- 
tangible network elements, wherein each of said net- 
work objects is defined by a set of attributes, each of 
said attributes having a value that represents a current 
state of the corresponding network element; 

event receiving means for enabling the processor to 
receive network event information from a plurality of 
network domains; 

topology receiving means for enabling the processor to 
receive network topology information; 

impacted network object identifying means for enabling 
the processor to identify each of said network objects 
that is impacted by said network event information, and 
each of said network objects mat is impacted by said 
network topology information, as impacted network 
objects, wherein said impacted network objects corre- 
spond to impacted network elements; 

impacted attribute identifying means for enabling the 
processor to identify each of said attributes of said 
impacted network objects that is impacted by said 
network event information and said network topology 
information as impacted attributes; 

attribute changing means for enabling the processor to 
change the value of said impacted attributes to reflect 
the impact of said network event information and said 
network topology information, thereby updating the 
current state of said impacted network elements to 
incorporate a state change and correlating network 
event information from at least one network domain 
with state changes in said at least one network domain 
and other network domains; 

state change detennining means for enabling the proces- 
sor to determine, for each of said impacted network 
elements, whether said state change is a significant 
state change; 

rule applying means for enabling the processor to apply, 
for each significant state change, an expert system rule 
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to produce an assessment of said significant state 
change and to provide said assessment to a network 
management workstation; and 
data providing means for enabling the processor to pro- 
vide data reflecting the current state of said network 3 
elements and the updated current state of said impacted 
network elements to the network management work- 
station. 

38. The computer program product of claim 37, further 
comprising: 10 

notification means for enabling the processer to generate, 
for each significant state change, a notification message 
that triggers said rule applying. means to apply the 
appropriate expert system rule. 

39. The computer program product of claim 37, wherein 15 
said network topology object database comprises a network 
state object data base containing a plurality of network state 
objects, wherein each of said network state objects is linked 

to a corresponding network object 

40. The computer program product of claim 39, wherein 20 
each of said network state objects is defined by a set of 
network state attributes that represent the dynamic state of 
the corresponding network object. 

41. The computer program product of claim 37, wherein 
said plurality of network domains comprises transmission, 23 
switching, customer traffic, and network routing domains. 

4Z A computer program product comprising a computer 
useable medium having computer program logic reccrded 
thereon for enabling a processor in a computer system to 
manage a telecommunications network, said computer pro- 30 
gram logic comprising: 
database maintenance means for enabling the processor to 
maintain a network object database comprising a plu- 
rality of network objects, wherein each of said network 35 
objects corresponds to at least one of a plurality of 
network elements, said plurality of network elements 



22 

including tangible network elements and non-tangible 
network elements, wherein each of said network 
objects is defined by a set of attributes, each of. said 
attributes having a value that represents a current state 
of the corresponding network element; 
receiving means for enabling the processor to receive 
network event information from a plurality of network 
domains; 

impacted network object identifying means for enabling 
the processor to identify each of said network objects 
that is impacted by said network event information as 
impacted network objects, wherein said impacted net- 
work objects correspond to impacted network ele- 
ments; 

impacted attributes identifying means for enabling the 
processor to identify each of said attributes of said 
impacted network objects that is impacted by said 
network event information as impacted attributes; 

attribute changing means for enabling the processor to 
change the value of said impacted attributes to reflect 
the impact of said network event information, thereby 
updating the current state of said impacted network 
elements to incorporate a state change and correlating 
network event information from at least one network 
domain with state changes in said at least one network 
domain and other network domains; and 

data providing means for enabling the processor to pro- 
vide data reflecting the current state of said network 
elements and the updated current state of said impacted 
network elements to a network management worksta- 
tion. 

43. The computer program product of claim 42, wherein 
said plurality of network domains comprises transmission, 
switching, customer traffic, and network routing domains. 

* * * * * 
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